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We designed high-efficiency error correcting codes allowing to extract an errorless secret key in a 
Continuous- Variable Quantum Key Distribution (CVQKD) protocol using a Gaussian modulation 
of coherent states and a homodyne detection. These codes are available for a wide range of signal- 
to-noise ratios on an Additive White Gaussian Noise Channel (AWGNC) with a binary modulation 
and can be combined with a multidimensional reconciliation method proven secure against arbitrary 
collective attacks. This improved reconciliation procedure considerably extends the secure range of 
CVQKD with a Gaussian modulation, giving a secret key rate of about 10~^ bit per pulse at a 
distance of 120 km for reasonable physical parameters. 



I. INTRODUCTION 

Quantum Key Distribution (QKD) [T is the first real- 
life application of quantum information. It allows two 
distant parties, Alice and Bob, to establish an uncondi- 
tional [2] secret key through the exchange of quantum 
states even in the presence of an eavesdropper, with the 
help of a classical auxiliary authenticated communication 
channel [3]. The first QKD vendors, ID Quantique [3] and 
MagiQ Technologies ^SJ, developed systems based on en- 
coding the information on discrete variables such as the 
phase or the polarization of single photons. The limita- 
tion of these technologies is mainly due to the speed and 
the efficiency of the single photon detectors. Recently 
created companies. Quintessence Labs [B] and SeQureNet 
[7] , are developing a new generation of systems that allow 
to get rid of these limitations by encoding the information 
on continuous variables (CV) such as the quadratures of 
coherent states. 

In the standard protocol [8j, one needs to prepare 
Gaussian modulated coherent states and to measure 
them with a homodyne or a heterodyne [5] detection 
which requires only standard telecommunication parts. 
With the current proof techniques, using a Gaussian 
modulation is optimal as regards the theoretical secret 
key rate. In particular, security against collective attacks 
is well understood (TUl |TT] , even in the finite-size regime 
[12], and collective attacks are known to be asymptoti- 
cally optimal TJ]. However, since the efficiency of the 
current reconciliation protocols for Gaussian variables 
drops dramatically in the regime of low signal-to-noise 
ratios (SNRs), new protocols using specific non-Gaussian 
modulations, either discrete ^14, or continuous [TS], have 
been developed. The idea of these modulations is that 
they are compatible with high-performance error correc- 
tion, making possible for the protocol parties to extract 
efficiently the information available in their raw data. 
This is in strong contrast with the Gaussian modula- 



tion for which no efficient reconciliation procedure was 
available until now. In theory, protocols with a non- 
Gaussian modulation therefore increase the achievable 
secure distance of CVQKD. They have, however, not yet 
been demonstrated experimentally. Indeed, for long dis- 
tances, that is low transmission of the quantum chan- 
nel, the optimal modulation variance is typically lower 
for non-Gaussian modulations (in particular for the four- 
state protocol [14 ) than for a Gaussian modulation. This 
makes the design a stable continuous- variable system able 
to operate at large distances difficult. Even if this effect 
is mitigated for the eight-dimension protocol [15], the 
modulation allowing for the largest variance remains the 
Gaussian one |3- 

In this paper, we exhibit high-efficiency error correct- 
ing codes which can be combined with a multidimen- 
sional reconciliation scheme [TB]. This allows, for the 
first time, to distill a secret key from a CVQKD protocol 
with a Gaussian modulation in the regime of very low 
SNR, and paves the way for future experimental demon- 
strations of CVQKD over much larger distances than the 
current record of 30 km [T7| [TH] . 

In Section [llj we explain how the problem of recon- 
ciling Gaussian variables can be translated into a chan- 
nel coding problem on the Binary Input Additive White 
Gaussian Noise Channel (BIAWGNC), for which we de- 



scribe very low rate error correcting codes in Section III 



Combining these tools, we are able to efficiently recon- 
cile data at low SNRs. Finally, we show in Section |IV| 
the consequences of these new developments on the per- 
formance of the Gaussian protocol over long distances. 



II. THEORY OF RECONCILIATION OF 
GAUSSIAN VARIABLES 



The data reconciliation step is critical in CVQKD: 
the distance of the chosen error-correction scheme to the 
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Shannon bound affects both the key rate and the range 
of the protocol. Of considerable importance is the prob- 
lem of the reconciliation of correlated Gaussian variables. 
This is indeed the scenario considered in the GG02 proto- 
col [8 where Alice's coherent states are modulated with a 
bivariate Gaussian distribution in phase space. Different 
approaches have been explored to increase the reconcili- 
ation efficiency for a Gaussian modulation, especially in 
the regime of low SNR. 

A first approach called Slice Reconciliation was pro- 
posed in 19, 20^ and implemented in [TTIHH] but the effi- 
ciency of this method currently limits the protocol range 
to about 30 km. Another method is to encode the in- 
formation on the sign of the Gaussian modulated value. 
However, since we deal with centered Gaussian variables, 
the uncertainty on the sign increases at low SNRs be- 
cause most values have small amplitude. Another class 
of protocols use post-selection |21H24] by working only 
with high-amplitude data but the security is not proven 
against general collective attacks. 

In [16], the idea of reducing the Gaussian variables 
reconciliation problem to the channel coding problem is 
introduced. One first uses a d-dimensional rotation to 
build a virtual channel close to the BIAWGNC from the 
physical Gaussian channel. This means that d consecu- 
tive instances of the physical channel are mapped to d 
approximate copies of a virtual BIAWGN channel, which 
are used to perform the error correction and eventually 
distill the actual secret. The final reconciliation efficiency 
one obtains with such a scheme depends on two things: 

• The intrinsic efficiency of the error correcting code 
used on the virtual channel on the BIAWGNC 
(such an efficiency is given for example in Table 

• The quality of the approximation between the vir- 
tual channel and the BIAWGNC (for the scheme 
given in |16j . the quality of this approximation in- 
creases with the dimension d). 

One can therefore improve the reconciliation efficiency 
of the global scheme by working on two things: design- 
ing codes with higher efficiencies on the BIAWGNC and 
increasing the dimension of the scheme. 

Let us now explain in more details the setting defined 
in |16j : Alice, the sender, and Bob, the receiver, are given 
two n-dimensional real vectors x and y and can use a 
public authenticated channel to agree on a common bit 
string u. For this, one of the parties (say Alice in the di- 
rect reconciliation scheme) sends to the other additional 
information describing a function / such that /(x) = u; 
the other party (Bob) applies this function to his data to 
get V := /(y); this way, a virtual communication channel 
with input u and output v is defined. The explicit con- 
struction of |16j aims at creating a virtual channel that 
is close to the BIAWGNC since very efficient codes are 
available for that channel. 



Alice and Bob are given two d-uplets x and y cor- 
responding to correlated Gaussian vectors (this is valid 
for CVQKD with a Gaussian modulation and a Gaus- 
sian optimal attack). This means that one can introduce 
constants i, t' and a, a' such that one has y = tx -I- z 
with X - A/'(0, l)'^, z - 7V(0,o-2)rf -^^ ^j^^ ^^^^^^ 

recon- 
ciliation case and x = t'y + z' with y ^ A/'(0, 1 -f cP'Y' i 
z"* ~ A/'(0, tr'^)'' in the reverse reconciliation case. Since 
the two scenarios are similar, we consider without loss of 
generality only the direct reconciliation one here. Fur- 
thermore, up to a simple rcnormalization, one can fix 
t = 1. 

Alice chooses a random element u g {— l/-\/d, l/v^}'' 
with the uniform distribution on the d-dimensional hy- 
percube and sends r = u.x~^ to Bob through the pub- 
lic channel (a "multiplication" and its inverse "division" 
operator are assumed to exist on d-dimensional vectors - 
more on this below). Then Bob computes v :— r.y. Let 
us analyse the noise w on this virtual channel: 

w := V u 
= ry u 

= u.x^"'" (x + z) — u 
z z 

X ||x|| 

where the last equality holds in law and is due to the 
spherical symmetry of the distributions of z and x and 
their independence. Since the norm of x is transmitted, 
the channel considered is a Fading Channel with Known 
Side Information as defined in ^3], the fading coefficient 
being the norm of x, which follows a x(rf) distribution 
with d degrees of freedom. Since the distribution x((i) 
gets closer to a Dirac distribution when d goes to infinity, 
one should use the highest dimension possible in order to 
obtain the degenerate version of the Fading Channel with 
Known Side Information where all the fading coefficients 
are equal to 1, that is, the BIAWGNC. Unfortunately, the 
required division operator only exists in dimensions 1,2, 
4 and 8 (where it can be built from the algebraic structure 
of K, C, H and O respectively), so that it is not possible 
to use the above algorithm in arbitrary dimension. 



III. RECONCILIATION OF GAUSSIAN 
VARIABLES: IMPLEMENTATION WITH LDPC 
CODES 

Low Density Parity Check (LDPC) codes (or Gallager 
codes) are linear error-correcting codes with a sparse par- 
ity check matrix. A good reference about general coding 
theory and LDPC codes is |25j. LDPC codes can be 
represented as bipartite graphs, one set of the nodes be- 
ing the check nodes representing the set of parity-check 
equations which define the code; the other, the variable 
nodes which represent the elements of the codewords. 
Variables nodes and check nodes are connected through 
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edges. LDPC codes are commonly used in telecommu- 
nications since they perform very close to Shannon limit 
and can be decoded with a fast iterative message-passing 
decoder called Belief Propagation (BP) (in such a decod- 
ing scheme, information is propagated between variable 
and check nodes that are connected by edges). These 
codes are designed for a given channel and a given SNR. 
The rate of a code is defined as the ratio between the in- 
formation bits and the total number of transmitted bits 
on the channel. A low rate code is therefore a code with 
a lot of redundancy bits. Correcting errors at very low 
SNRs implies to design codes with low rates since adding 
redundancy allows to correct more errors. 

A standard way to characterize LDPC codes is the 
probabilistic method: an ensemble of LDPC codes C is 
characterized by the node degrees and one proves that 
good codes occur with high probability within this en- 
semble. A specific code is simply drawn randomly from 
this set. Then one can modify the node degrees and their 
probabilities of occurence to improve the performance of 
the codes of the ensemble. A well known method to op- 
timize LDPC codes for a given rate and a given chan- 
nel is to use a genetic algorithm called Differential Evo- 
lution. This method has been successfully applied for 
a wide range of channels: the Binary Erasure Channel 
(BEC) the BIAWGNC [17] and the Binary Sym- 

metric Channel (BSC) [55]. The cost function that is 
maximized using this algorithm is defined as the thresh- 
old value for the channel (i.e. the maximal value of the 
noise that can be corrected with a given code, e.g. the 
standard deviation a of the noise for the BIAWGNC or 
the probability of error e for the BSC) and Discretized 
Density Evolution is used to compute the threshold. 

In CVQKD, we need low-rate and high-efficiency codes 
for the BIAWGNC since errors must be efficiently cor- 
rected at very low SNRs to increase the secure distance. 
Multi- edge-type LDPC codes [29j give simple structures 
allowing to operate very close to Shannon limit at very 
low SNRs (for another construction of low rate LDPC 
codes refer to [30]). In the multi-edge setting, several 
edge classes are defined on the bipartite graph; then ev- 
ery node is defined by its number of sockets in each class. 
Whereas for standard LDPC ensembles the graph con- 
nectivity is constrained only by the node degrees, the 
multi-edge-type setting allows a greater control over the 
graph because only sockets of the same class can be con- 
nected together. Unlike standard LDPC ensembles, this 
framework provides for example the possibility to use 
degree- 1 edges which improves significantly the thresh- 
old. 

Every known reconciliation technique for CVQKD 
with a Gaussian modulation achieves an efficiency less 
than or equal to 90% [17, 20, 31^. This efficiency param- 
eter (3 (defined by (3{s) = R/cls) for a SNR s where R 
is the code rate used for the reconciliation and C is the 
capacity of the Additive White Gaussian Noise Chan- 
nel (AWGNC)) is critical since the asymptotic secure 
key rate in the reverse reconciliation scheme is given by 



R Sue Cth Pde 
0.1 0.156 0.10429 95.9% 
0.05 0.074 0.05144 97.2% 
0.02 0.029 0.02038 98.1% 



TABLE I. SNR asymptotic thresholds [sde) on the BI- 
AWGNC, corresponding channel capacities (Cth) and efficien- 
cies (Pde) given by Density Evolution for low rate multi-edge 
LDPC codes of rate R. 

K = PI{x\ y) — x{y\ where both /(x; y) (the mutual 
information between the two protagonists bit strings x 
and y) and x(y; E) (the Holevo information between the 
eavesdropper and the receiver's data) are large compared 
to K. One should especially pay attention to the depen- 
dency of /3 on the SNR. In [17, 20,115, the good efficiency 
values are obtained only for SNRs higher than 1 which 
is incompatible with long distances. In [TB], a 90% effi- 
ciency is obtained for a 0.5 SNR which allows to extend 
the secure distance from 30 km to 50 km. In this paper, 
we obtain higher efficiencies for even lower SNRs which 
allows secure key distribution over longer distances. 

Let us now review low rate LDPC codes with a good ef- 
ficiency available in literature. In [29], table IX, a 95.9% 
efficiency, rate 1/10 code for the BIAWGNC is described. 
This efficiency can be further improved through an op- 
timization of the distribution coefficients as mentioned 
in [29j. Starting from the structure of this code we de- 
signed codes with lower rates and with higher asymptotic 
thresholds. Table[l]sums up the performances of this orig- 
inal code together with our set of new multi-edge LDPC 
codes (the actual structure of the rate 0.02 code is de- 
scribed as an example in Appendix [A]). In this table, R is 
the rate of the considered code, sdb is the SNR threshold 
given by Discretized Density Evolution, Cth is the the- 
oretical channel capacity for this level of noise and 13 de 
is the efficiency of the code. These results are valid in 
the asymptotic regime, i.e. for codes of infinite length. 
However, the efficiency that is obtained with codewords 
of length 2^" is within 1% of the asymptotic efficiency. 

A. Simulation Results with Rotations on , 
and S'' 

Let us discuss the simulation results we obtained ap- 
plying the multidimensional reconciliation scheme with 
the previous codes for a dimension d — 2, d — 4 and 
d — 8, for the sign coding technique [d — 1) and without 
using any additional information, i.e. when we try to 
use a code designed for the BIAWGNC with a Gaussian 
modulation. 

Tables [llj and IIIII summarize the efficiencies we ob- 
tained with respect to the Gaussian channel capacity 
with our multi-edge LDPC codes for a block size of 
2^'^. We obtained a ciuitc high Frame Error Rate (FER) 
(about 1/3) but a nuU Bit Error Rate (BER) on the 
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R 


s 


Sd=l 


Sd=2 


Sd=4 


Sd=8 


0.1 


0.271 


0.187 


0.169 


0.163 


0.161 


0.05 


0.123 


0.082 


0.077 


0.076 


0.075 


0.02 


0.047 


0.030 


0.029 


0.029 


0.029 



TABLE II. SNR thresholds on the BIAWGNC for low rate 
multi-edge LDPC codes (size 2^") using the multidimensional 
reconciliation scheme (d — 1, 2, 4, 8). 



R 


P 


/3d=i 


/3d=2 


/3d=4 


I3d=8 


0.1 


57.9% 


80.8% 


88.7% 


92.1% 


93.1% 


0.05 


59.7% 


88.3% 


93.5% 


94.8% 


95.8% 


0.02 


60.0% 


93.1% 


96.3% 


96.6% 


96.9% 



TABLE III. Efficiencies (w.r.t. the BIAWGNC capacity) for 
low rate multi-edge LDPC codes (size 2^") using the multidi- 
mensional reconciliation scheme (d = 1, 2, 4, 8) 



blocks where the decoding succeeded. This means that 
concatenating our codes with very high rate codes hke 
BCH codes to remove the residual errors (as was done in 
[T71IIH]) is not necessary here. 

Since the channel obtained with rotations is not ex- 
actly a BIAWGNC, the efhciencies f3 are always lower 
than the efficiencies predicted by density evolution on 
the BIAWGNC. However, increasing the dimension d of 
the rotations allows to get closer to the efficiency of the 
code on the BIAWGNC. This is expected since the norm 
of the input vector u''||a;''|| of the virtual channel follows 
a distribution xid) (where d is the number of degrees of 
freedom), which gets closer to a Dirac when d tends to 
infinity. 

Figure [T] compares the capacities of the BIAWGNC and 
the multidimensional virtual channels for d = 1, 2, 4, 8 as 
a function of the SNR. 




- d = 1 / biawgu (1) 
d = 2 I biawgii (2) 
d = A / biawgn (3) 
d = S / biawgn (4) 

- biawgn / awgn (5) 
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FIG. 1. (Color online) Ratios between the capacities of the 
multidimensional channels {d — 1, 2, 4, 8) and the BIAWGNC 
and between the BIAWGNC and the AWGNC with respect 
to the SNR 



B. Use of rotations in higher dimension spaces 

As was explained in the previous section, the multidi- 
mensional reconciliation scheme is limited to dimensions 
1,2,4 and 8 because these are the only ones compatible 
with a division structure [TB] . 

In [inj, the following construction applicable to arbi- 
trary dimension d is proposed. In the direct case, with 
the same notations as in paragraph |ll] (where Alice has a 
vector X, Bob a vector y, and Ahce uses (x, r) to 'virtu- 
ally' send u to Bob), a random orthogonal transformation 
Q on M.'^ is drawn according to the Haar mesure, then Q 
is composed with the reflection S across the mediator 
hyperplane of x' — Q(x) and u. The resulting matrix 
R = S o Q sends x to u and y to a point close to u, be- 
cause R preserves the euclidean distance; R is revealed 
by Alice and plays the same role as the vector r in sec- 
tion |TTj The randomization provided by Q ensures that 
R does not reveal more information on (x, u) than the 
relation i?(x) = u; in particular, all u are equally likely 
given R. 

Q is built, for instance, as the orthogonal ('Q') part of 
the QR decomposition of a d x d matrix G of Gaussian 
normalized random values. This method has complex- 
ity 0{d'^). All other known methods to draw random 
orthogonal matrices have the same complexity. 

We propose a method that allows to reduce the com- 
plexity to 0{d^). Let us observe first that we have the 
choice of the encoding of R: we do not need to reveal it 
in matrix form. However, the encoding must not reveal 
anything about u except that R satisfies i?(x) = u. For 
instance, with the first method, revealing separately Q 
and S instead of i? = S" o Q is not a good idea since 5" 
leaks information about u: indeed, in high dimension d, 
two random independent vectors are approximately or- 
thogonal and therefore their mediator hyperplane forms 
and angle of about 7r/4 with either vector. 

Let us examine first how an orthogonal transform 
Q can be drawn according to the Haar measure with 
complexity ©(c?^), using an adequate representation, 
the Householder decomposition. An orthogonal basis 
ei,...,ed is fixed. Let E (resp. F) be the span of 
ei,...,ed (resp. e2,...,ed). 

li d — 1, choose -1-1 or —1. If d > 1, choose a ran- 
dom vector g uniformly on S'^~^, the unit sphere in M'' 
(it can be constructed as g — h/||h|| where h has in- 
dependent normalized Gaussian coordinates), and draw 
recursively a random orthogonal matrix Q' of dimension 
d—1, viewed as a transform of F. Q' is extended to E by 
setting Q'{ei) — ei. Let S be the reflection that sends ei 
on g, and define Q — S oQ' . Q' is itself a composition of 
d—1 reflections in spaces of dimensions d — 1, . . . , 1. De- 
scribing each reflection by its corresponding eigenvector 
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for the eigenvalue -1, Q is described by d vectors of di- 
mensions d, d — 1, . . . , 1, for a total of '^^'^^"'"^ coefficients. 
The decomposition is unique. Note that Q{ei) — g. 

This process can be adapted when a constraint (5(x) = 
u is added, with ||x|| = ||u||. If d = 1, choose +1 or —1 
depending on x = u or x = — u. Assuming d > 1, g is 
chosen uniformly at random among unit vectors s.t. 



u • g = X • ei 



(1) 



where • is the dot product. This relation is required for Q 
to satisfy both Q(x) — u and Q(ei) = g. Starting from 
a Gaussian normalized vector h, a is chosen uniformly 
so that (h + au) • u = (x • ei) x ||h + au|| (this is a 
quadratic equation that has at least one solution except if 
h, u span the same line, and ei, x do not, which happens 
with probability 0). g = is computed in linear 

time and satisfies Q. 

For an arbitrary vector v, write its decomposition on 
F ^ ei as V = Vi?-|-Vpi . Q' is drawn recursively, satisfying 
Q'(xi?) = S{u)f- This is possible because x • ei = u • 
g = u • S'(ei) = >5'(u) • ei implies x^j_ = S{vl)p± and 
||xj.|| = \\S{xi)f\\. Then as Q' {e^) = e^, Q'(x) = S{u). 

Define Q = o Q' as before: Q(x) = 5(g'(x)) = u. 

The algorithm still runs in 0{(P), and the decompo- 
sition does not reveal any side information because it is 
unique. Since the added constraint ([T]) is required for the 
relation Q{'x.) = u to hold, one sees recursively that the 
process yields the correct distribution on Od- Finally, 
given the d reflection vectors, computing (3(z) for any 
z is also done in time 0{d?). Hence by revealing these 
vectors instead of Q in matrix form, one gets the desired 
0{(P) algorithm. 

Let us now consider the rate 1/2 multi-edge LDPC 
code given in Table VI of reference [W . The SNR thresh- 
old given by Discretized Density Evolution is s* — 1.074. 
The corresponding efliciency on the BIAWGNC is 98.2%. 



When using a Gaussian modulation, table IV shows the 
effect of the dimension d on the efhciency /3 of the recon- 
ciliation scheme. We can see that increasing the dimen- 
sion above 8 when operating at a high SNR enables to 
increase significantly the efficiency, and therefore the key 
rate in QKD applications. 



C. Dealing with a continuous range of SNR with 
puncturing, shortening and repetition 



We designed good efficiency codes for a finite set of 
rates so far; we are going to show how to deal with a 
continuous range of SNRs with this finite set. Since we 
designed low rate codes with good efficiencies, we can ap- 
ply the simple technique of repetition codes mentioned 
in |32j . It is shown that starting from a code of rate 
R achieving an efficiency /3(s) for a SNR s on the BI- 
AWGNC, one can use a repetition scheme of length k to 



d 


a 




2 


1.644 


76.3% 


4 


1.336 


85.7% 


8 


1.194 


91.7% 


16 


1.144 


94.3% 


32 


1.108 


96.2% 


64 


1.097 


96.9% 



TABLE IV. SNR thresholds and channel efficiencies on the 
BIAWGNC for the rate 1/2 multi-edge LDPC code in Table 
VI of ref. [12] with respect to the dimension of the multidi- 
mensional reconciliation scheme 



build a new code of rate R = R/k achieving an efhciency 
/?' for a SNR s' = s/k given by 



(3\s/k) = (3{s) 



l0g2(l + g) 

klog^il + s/k) 



For example, using a repetition scheme of length 3 with 
our code of rate 0.02 and efficiency 98% for a SNR 
of 0.03, we can build a code of efficiency /3(0.01) — 



0.98 



log2(l-03) 



97%. We applied this technique with 



'31og2(1.01) 

repetition factors of 2 and 4 with our code of rate 0.02 to 
obtain the codes of rates 0.01 and 0.005 given in Table 

13 

However, this technique allows a low efficiency loss only 
for very small SNRs. For higher SNRs, other techniques 
must be applied if we want to keep very good efficien- 
cies. Puncturing and shortening for LDPG codes are a 
good way to adapt the rate of a code [33j- Let us start 
with a (n, fc) code, i.e. a code of length n with n — k 
bits of redundancy; the rate is R = k/n. Puncturing 
consists in deleting a predefined set of p symbols from 
each word, converting a (n, k) code into a (n — p, k) code. 
Shortening means deleting a set of s symbols from the 
encoding process (or revealing s message bits in addition 
to the syndrome in each codeword), converting a {n,k) 
code into a {n — s,k — s) code. With a combination of 
these techniques the rate obtained is 



R 



n — p ' 



The loss of efficiency incurred is small for small relative 
variations of the code rate. Typically, one can achieve 
a decrease of 5% (though shortening) and an increase 
of 10% (through puncturing) of the code rate with an 
efficiency loss smaller than 1%. 



IV. PRACTICAL USE FOR A 
CONTINUOUS- VARIABLE QUANTUM KEY 
DISTRIBUTION SYSTEM 



In this section, we apply the techniques developed in 
the previous sections to GVQKD in order to increase the 



R 


P 


s 


0.5 


93.6% 


1.097 


0.1 


93.1% 


0.161 


0.05 


95.8% 


0.075 


0.02 


96.9% 


0.029 


0.01 


96.6% 


0.0145 


0.005 


95.9% 


0.00725 



30 



TABLE V. SNR thresholds and channel efficiencies on the 
AWGNC of the multi-edge LDPC codes mentionned in this 
paper. 

secure distance achievable. We have to take into account 
that our quantum channel is Gaussian so that code effi- 
ciencies must be computed w.r.t. this channel capacity: 

^ Cawgnc 

where R is the rate of the code and Cawgnc is the 
capacity of the AWGNC. As we can see on Figure [T] the 
capacity of the BIAWGNC is very close to the capacity 
of the AWGNC for small values of the SNR. We give the 
efficiencies we can achieve on the AWGNC for different 
SNRs in Table El 

Our set of codes allows us to correct errors with an 
efficiency of about 95% for some fixed low SNRs. Let us 
plot the secret key rate as a function of the SNR on Bob 
side for a given distance and assuming a fixed error cor- 
rection efficiency /3. This enables to determine for which 
particular SNR it is relevant to design error-correcting 
code in order to maximize the secret key rate. We do 
not consider in this paper finite-size effects |12j , meaning 
that our figures represent the key rate in the regime of 
infinite block length. In order to take finite-size effects 
into account two approaches are possible: a theoretical 
one consists in improving the proofs and the bounds on 
the secret key rate [S3], a more practical one consists 
in designing systems with sufficient hardware stability in 
order to compute keys on large blocks. 

The modulation variance is restricted within the inter- 
val [1, 100] (in shot noise units) since lower values make 
the experimental setup much more complex. Indeed, 
a very low modulation variance is not compatible with 
brighter synchronization and phase tracking signals, be- 
cause of the limited extinction ratios of the optical mod- 
ulators (30dB for the most common models). An attenu- 
ation of 0.2dB/km is assumed. The homodyne detection 
efficiency is set to 0.6, and a value of 1% of the shot noise 
is taken for the electronic noise of the homodyne detec- 
tion [T71 [TB] . A conservative value of 4% of the shot noise 
as in the European project SECOQC (Secure Communi- 
cation based on Quantum Cryptography) |18j is used for 
the excess noise in Figur e [4| w hile a more optimistic figure 
of 1% is used in Figures [2] [3| and [s] This second value is 
also typical of a realistic CVQKD system [T7] . 

Figure [2] shows the optimal variance modulation on Al- 
ice side with respect to the key rate as a function of the 
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FIG. 2. (Color online) Optimal modulation variance with 
respect to the distance: rj = 0.6, V^iec = 0.01, ^ = 0.01, 
a = 0.2dB/km, P = 95% and 13 = 90% from top to bottom. 
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FIG. 3. (Color online) Secret key rate for collective attacks 
with respect to the SNR: 7] = 0.6, Veiec = 0.01, C = 0.01, 
a = 0.2dB/km, Va e {1,100}, /3 = 95% and P = 90%, 
D = 10, 20, 50, 100 km. 



distance. Achieving a good reconciliation efficiency at 
any SNR allows to work with a high modulation variance. 
This compares favorably to previous schemes with a dis- 
crete modulation which require modulation variances 10 
times lower than the ones shown here. 

Figure [3] and |4j plotted respectively for an excess noise 
of 1% and 4% of the shot noise, show that an improve- 
ment on the reconciliation efficiency yields at any dis- 
tance a wider range of SNR with a close-to-optimum se- 
cret key rate. Conversely, the range of distances where a 
given error-correcting code working close to its threshold 
SNR can be used to get an almost optimal key rate is 
increased. 

Given these large distance ranges where an error- 
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FIG. 4. (Color online) Secret key rate for collective attacks 
with respect to the SNR: r) = 0.6, VeUc = 0.01, i = 0.04, 
a = 0.2dB/km, Va G {1,100}, /3 = 95% and /3 = 90%, 
D = 10, 20, 50, 100 km. 
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correcting code is usable, it becomes feasible to use a 
small family of error-correcting codes to perform the rec- 
onciliation step at any distance and without using rate- 
tuning techniques such as puncturing or shortening. Fig- 
ure [5] shows the key rate and the maximum secure dis- 
tance obtained with this simple approach and the codes 
ofTablelxl With an excess noise of 1% of the shot noise, a 
secure distance above 150 km is obtained (with an excess 
of noise of 4% and the same codes, the secure distance 
is above 140 km) . This is a significant improvement over 
previous reconciliation techniques since a reconciliation 
efficiency of 90% for a SNR of 0.5 only allows a secure 
distance of about 50 km with a Gaussian modulation |16j . 



V. CONCLUSION 

We designed high-efficiency error-correcting codes al- 
lowing to distribute secret keys with a continuous- 
variable quantum key distribution system using a Gaus- 
sian modulation over long distances. Our results give a 
secure distance above 150 km against collective attacks 
(in the asymptotic regime) and can be implemented with 
only software modifications in the experimental setups of 
[m and [E]. 
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FIG. 5. (Color online) Secret key rate for collective at- 
tacks with respect to the distance: rj = 0.6, Veiec = 
0.01, C = 0.01, a = 0.2dB/km, Va G {1,100}, 
SNR = 1.097,0.161,0.075,0.029,0.0145,0.00725, /3 = 
93.6%, 93.1%, 95.8%, 96.9%, 96.6%, 95.9% from left to right. 



Appendix A: A rate 1/50 multi-edge LDPC code 
{a* = 5.91 on the BIAWGNC) 

Below is the description of a multi-edge LDPC ensem- 
ble of codes of rate R = 0.02. The left half of the array 
describes the multidegree distributions of variable nodes, 
and the right half the distribution of check node multide- 
grees. m stands for a multidegree distribution of proba- 
bility fm at the variable nodes and fj,m at the check nodes. 
For instance, with probability 0.0225, a variable node has 
multidegree [2, 57, 0], i.e. it has 2 sockets for edges of 
type 0, 57 sockets for edges of type 1, and no socket of 
type 2. Check node probabilities sum to 1 — i? = 0.98 
since there is 0.98 check node for 1 variable node. 
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